fix(configure): reject literal "undefined" and "null" gateway auth tokens#13767
fix(configure): reject literal "undefined" and "null" gateway auth tokens#13767steipete merged 7 commits intoopenclaw:mainfrom
Conversation
b1b5eea to
f0372d9
Compare
…nto fix/configure-undefined-token # Conflicts: # src/commands/configure.gateway-auth.ts # src/commands/onboard-helpers.e2e.test.ts # src/commands/onboard-helpers.ts
|
Superseded by the updated landed comment below with concrete SHAs. Landed via synced main + squash merge.
Thanks @omair445! |
|
Landed via synced main + squash merge.
Thanks @omair445! |
|
Landed via synced main + squash merge.
Checking formatting... All matched files use the correct format.
Found 0 warnings and 0 errors.
A2UI bundle up to date; skipping.
[copy-hook-metadata] Copied boot-md/HOOK.md
RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 ✓ extensions/twitch/src/twitch-client.test.ts (30 tests) 40ms Test Files 44 passed (44) ✓ src/auto-reply/status.test.ts (21 tests) 471ms Manage model auth profiles Options: Commands: Test Files 93 passed (93) ✓ src/tui/tui-formatters.test.ts (8 tests) 7ms Test Files 613 passed (613) Thanks @omair445! |
|
Landed via synced main + squash merge.
Checking formatting... All matched files use the correct format.
Found 0 warnings and 0 errors.
A2UI bundle up to date; skipping.
[copy-hook-metadata] Copied boot-md/HOOK.md
RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 RUN v4.0.18 /Users/steipete/Projects/clawdbot7/.worktrees/pr-13767 ✓ extensions/twitch/src/twitch-client.test.ts (30 tests) 45ms Test Files 44 passed (44) ✓ src/media/store.test.ts (14 tests) 577ms Manage model auth profiles Options: Commands: Test Files 1 failed | 92 passed (93) ✓ src/wizard/session.test.ts (3 tests) 10ms Test Files 613 passed (613) ELIFECYCLE Test failed. See above for more details. Thanks @omair445! |
…kens (openclaw#13767) * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): validate gateway password prompt and harden token coercion (openclaw#13767) (thanks @omair445) * test: remove unused vitest imports in baseline lint fixtures (openclaw#13767) --------- Co-authored-by: Luna AI <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
…kens (openclaw#13767) * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): validate gateway password prompt and harden token coercion (openclaw#13767) (thanks @omair445) * test: remove unused vitest imports in baseline lint fixtures (openclaw#13767) --------- Co-authored-by: Luna AI <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
|
Thanks for merging @steipete! Glad this one made it in 🙏 |
…kens (openclaw#13767) * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): validate gateway password prompt and harden token coercion (openclaw#13767) (thanks @omair445) * test: remove unused vitest imports in baseline lint fixtures (openclaw#13767) --------- Co-authored-by: Luna AI <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
…kens (openclaw#13767) * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): validate gateway password prompt and harden token coercion (openclaw#13767) (thanks @omair445) * test: remove unused vitest imports in baseline lint fixtures (openclaw#13767) --------- Co-authored-by: Luna AI <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
…kens (openclaw#13767) * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): reject literal "undefined" and "null" gateway auth tokens * fix(configure): validate gateway password prompt and harden token coercion (openclaw#13767) (thanks @omair445) * test: remove unused vitest imports in baseline lint fixtures (openclaw#13767) --------- Co-authored-by: Luna AI <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>
Summary
openclaw configurecan write the literal string"undefined"asgateway.auth.tokenwhenparams.tokenis JSundefined. This creates a guessable/known token that poses a security risk and can cause gateway issues under load.Fixes #13756
Root Cause
buildGatewayAuthConfigdirectly assignsparams.tokenwithout guarding againstundefined, empty, or the literal strings"undefined"/"null"(common JS coercion artifacts). WhileJSON.stringifyomitsundefinedobject values, the token can arrive as the string"undefined"via template literal interpolation orString(undefined)in certain code paths.Behavior Changes
buildGatewayAuthConfignow sanitizes token/password values: rejectsundefined, empty strings, and the literal strings"undefined"and"null"normalizeGatewayTokenInputnow rejects"undefined"and"null"strings (returns""so the caller falls back torandomToken())Codebase and GitHub Search
buildGatewayAuthConfig(configure.gateway.ts, configure.wizard.ts)normalizeGatewayTokenInputusage (configure.gateway.ts, onboard-helpers.ts)normalizeGatewayTokenInput(tokenInput) || randomToken()— this fix hardens the deeper layersTests
All existing + 7 new tests pass (18 total):
configure.gateway-auth.test.ts (+4 new):
omits token when undefined is passedrejects the literal string "undefined" as tokenrejects the literal string "null" as tokenomits password when undefined is passedonboard-helpers.test.ts (+2 new):
rejects the literal string "undefined"rejects the literal string "null"lobster-biscuit
Sign-Off
Greptile Overview
Greptile Summary
This PR hardens gateway auth configuration handling by sanitizing token/password inputs and rejecting common JS-coercion artifacts (the literal strings
"undefined"and"null").Changes are centered in
src/commands/configure.gateway-auth.ts, adding asanitizeAuthValue()helper and using it insidebuildGatewayAuthConfig()so that invalid/empty values are omitted instead of being written intogateway.auth.*. Separately,normalizeGatewayTokenInput()insrc/commands/onboard-helpers.tsnow returns""for"undefined"/"null"after trimming, preserving the existingnormalizeGatewayTokenInput(tokenInput) || randomToken()fallback behavior in gateway setup flows.Tests were expanded to cover undefined and literal-string token/password cases in both the auth builder and token normalizer.
Confidence Score: 5/5
GatewayAuthConfigpermits optionaltoken/password, and downstream auth resolution/authorization already treats missing secrets as misconfiguration rather than silently authenticating.